The User-Agent request header identifies the application, operating system, vendor, and version of the requesting HTTP client.

Syntax and format conventions

According to RFC 9110 Section 10.1.5, the User-Agent header consists of product tokens and optional comments:

User-Agent: <product> / <product-version> ( <comment> )

API client best practice example

When designing API integrations or microservice HTTP clients, include the application name, version, and contact information:

User-Agent: InventorySyncService/2.4.0 (+https://example.test/bot; dev-team@example.test)

WAF and bot filtering

Many Web Application Firewalls (WAFs) and anti-scraping layers (Cloudflare, AWS WAF, Akamai) automatically block or challenge requests that present generic or missing User-Agent headers, returning HTTP 403 Forbidden:

  • Default curl/7.x.x or python-requests/2.x.x agents are frequently blocked on public web portals.
  • Missing or empty User-Agent headers are often classified as malicious scraper traffic.

For troubleshooting 403 blocks related to user agent inspection, see our guide on HTTP 403 Forbidden.

How to customize User-Agent with curl

Supply a custom User-Agent using the -A or -H flag:

curl -i -A "MyApiClient/1.0 (+https://example.test)" https://api.example.test/v1/health

Key takeaway

The User-Agent header allows servers to identify client software. In API development, providing a clear, structured User-Agent header prevents unintended WAF blocks (403 Forbidden) and facilitates operational debugging in server access logs.